Merge pull request #629 from warmbly/ci/serialize-release-runs

feat: serialize release workflow runs so two tags cannot race the buildx cache

.github/workflows/release.yml

@@ -5,6 +5,19 @@ on:
     tags:
       - "v*.*.*"
 
+# One release at a time. Every build writes a buildx cache scope named after
+# the service, so two releases running together export to the same scope and
+# one of them loses the race: the layer blob it is writing disappears under it
+# and the whole build ends on "error writing layer blob: not_found", after the
+# compile succeeded. Tagging twice in quick succession is the ordinary way to
+# hit that, and it reads as a broken build rather than a collision.
+#
+# Not cancel-in-progress: a release that is half-way through pushing images is
+# the last thing that should be interrupted. The second tag waits its turn.
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 env:
   REGISTRY: ghcr.io
   IMAGE_PREFIX: ghcr.io/${{ github.repository_owner }}/warmbly